Hey @sov_gwright I think i got to the bottom of the error. Firstly open up the Audience dashboard and clone it. This is to ensure we are not breaking anything to confirm the issue and changes Let me explain with an example about what I have drilled down for the "Error in 'map': Did not find value for required attribute " message. | makeresults | eval Site="%" | eval Status ="" | map search="|makeresults | eval _raw = \"Site, Status Site1, ON Site2, ON , OFF Site4, ON \" | multikv forceheader=1 | where like(Site, \"%\".$Site$.\"%\") | table Site Status" | table Site Status The above should return Site1, Site2 and Site4. Splunk's Search Parser replaces $Site$ to "SITE_VALUE" If we do the same with $$ | makeresults | eval Site="%" | eval Status ="" | map search="|makeresults | eval _raw = \"Site, Status Site1, ON Site2, ON , OFF Site4, ON \" | multikv forceheader=1 | where like(Site, \"%\".$$Site$$.\"%\") | table Site Status" | table Site Status The Search Parser does something different: SearchParser - PARSING: | where like(Site,(("%" . '"%"') . "%")). So in the cloned dashboard, edit click edit search on the Pageviews panel. Issue: The site and other values contains $$ and is also enclosed in quotes \". Fix: replace \"$$ and $$\" OR "$$ and $$" with $ respectively. ... View more

This works great, I did have to add a couple of things - on the Setup/Websites page the query doesn't include the Weblogic source type so no sites show up. I also had to manually add that sourcetype to the eventtypes.conf I'd modified in local because my data is in a different index. ... View more

Hi @sov_gwright, good, I'm glad to help you. about the new question, me or other people in Community will surely help you, but, please create a new request. Ciao. Giuseppe ... View more

Hi This should be what is at the end of the url, something like index.html . Check the field extractions for the field. The app comes bundled with field extractions for some known sourcetypes but they do not always work. Let me know how you get along. johan ... View more

There is no directory called etc/deployed-apps, only deployment-apps. Deployed apps from a deployment server are deployed to /etc/apps on the client 🙂 have this in mind please 🙂 you can also just create an app in /etc/apps/ on the indexer to contain the props and transforms in > /etc/apps/<app_name>/local ... View more

Awesome @sov_gwright thanks. Just so you know, there is metric store version of both the TA and the App: https://splunkbase.splunk.com/app/3947/ I'll let you choose which comment/reply to tag as a reply. ... View more